City: unknown
Region: unknown
Country: Canada
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 137.207.146.139
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 60837
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;137.207.146.139. IN A
;; AUTHORITY SECTION:
. 149 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022092803 1800 900 604800 86400
;; Query time: 64 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Thu Sep 29 11:22:34 CST 2022
;; MSG SIZE rcvd: 108Host 139.146.207.137.in-addr.arpa not found: 2(SERVFAIL)
server can't find 137.207.146.139.in-addr.arpa: SERVFAIL| IP | Type | Details | Datetime |
|---|---|---|---|
| 52.177.165.30 | attack | Tried to connect to TCP Port on PC |
2020-08-10 14:47:08 |
| 187.214.27.117 | attack | Automatic report - Port Scan Attack |
2020-08-10 15:00:19 |
| 197.243.48.18 | attackspam | 197.243.48.18 - - [10/Aug/2020:04:53:27 +0100] "POST /wp-login.php HTTP/1.1" 200 5667 "http://app.gpathome.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" 197.243.48.18 - - [10/Aug/2020:04:53:28 +0100] "POST /wp-login.php HTTP/1.1" 200 5667 "http://app.gpathome.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" 197.243.48.18 - - [10/Aug/2020:04:53:29 +0100] "POST /wp-login.php HTTP/1.1" 200 5667 "http://app.gpathome.com/wp-login.php" "Mozilla/5.0 (Windows NT 6.1; rv:60.0) Gecko/20100101 Firefox/60.0" ... |
2020-08-10 15:05:37 |
| 61.51.95.234 | attackbotsspam | Bruteforce detected by fail2ban |
2020-08-10 15:01:08 |
| 34.214.83.12 | attackbotsspam | Aug 10 09:31:03 pkdns2 sshd\[39069\]: Invalid user cb2 from 34.214.83.12Aug 10 09:31:05 pkdns2 sshd\[39069\]: Failed password for invalid user cb2 from 34.214.83.12 port 52172 ssh2Aug 10 09:35:35 pkdns2 sshd\[39238\]: Invalid user intel from 34.214.83.12Aug 10 09:35:37 pkdns2 sshd\[39238\]: Failed password for invalid user intel from 34.214.83.12 port 37606 ssh2Aug 10 09:40:05 pkdns2 sshd\[39452\]: Invalid user osm from 34.214.83.12Aug 10 09:40:08 pkdns2 sshd\[39452\]: Failed password for invalid user osm from 34.214.83.12 port 51274 ssh2 ... |
2020-08-10 15:15:10 |
| 118.24.70.248 | attackspambots | Banned for a week because repeated abuses, for example SSH, but not only |
2020-08-10 14:51:50 |
| 1.161.88.1 | attackbots | 1597031596 - 08/10/2020 05:53:16 Host: 1.161.88.1/1.161.88.1 Port: 445 TCP Blocked |
2020-08-10 15:14:00 |
| 185.100.87.190 | attack | Hacking |
2020-08-10 14:48:58 |
| 112.19.94.19 | attackbots | Banned for a week because repeated abuses, for example SSH, but not only |
2020-08-10 14:46:07 |
| 193.27.14.206 | attackbotsspam | Phishing email sender |
2020-08-10 15:24:28 |
| 218.92.0.173 | attackbotsspam | Fail2Ban - SSH Bruteforce Attempt |
2020-08-10 15:08:57 |
| 103.236.115.165 | attackbotsspam | 2020-08-10T06:59:52.805632shield sshd\[24644\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.115.165 user=root 2020-08-10T06:59:54.979373shield sshd\[24644\]: Failed password for root from 103.236.115.165 port 45950 ssh2 2020-08-10T07:04:20.135550shield sshd\[25006\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.115.165 user=root 2020-08-10T07:04:21.767373shield sshd\[25006\]: Failed password for root from 103.236.115.165 port 57112 ssh2 2020-08-10T07:08:51.452755shield sshd\[25373\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.115.165 user=root |
2020-08-10 15:27:00 |
| 116.62.147.109 | attackspambots | (mod_security) mod_security (id:920350) triggered by 116.62.147.109 (CN/-/-): 1 in the last 600 secs; Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: 2020/08/10 05:53:10 [error] 445087#0: *59085 [client 116.62.147.109] ModSecurity: Access denied with code 406 (phase 2). Matched "Operator `Rx' with parameter `^[\d.:]+$' against variable `REQUEST_HEADERS:Host' [redacted] [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "718"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [redacted] [severity "4"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [redacted] [uri "/"] [unique_id "159703159028.686758"] [ref "o0,17v21,17"], client: 116.62.147.109, [redacted] request: "GET / HTTP/1.1" [redacted] |
2020-08-10 15:16:42 |
| 174.110.88.87 | attack | Bruteforce detected by fail2ban |
2020-08-10 15:09:22 |
| 193.106.29.210 | attackbots | nginx/IPasHostname/a4a6f |
2020-08-10 15:19:31 |